« Volver al listado

CVE-2016-4320

Estado: ModificadaMedia (4.3)—

Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Atlassian — Bitbucket

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-4320",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Atlassian Bitbucket Server before 4.7.1",
          "versions": [
            {
              "status": "affected",
              "version": "Atlassian Bitbucket Server before 4.7.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-04-10T03:59:01.247",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/97515",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://confluence.atlassian.com/bitbucketserver/bitbucket-server-4-7-release-notes-829052416.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://jira.atlassian.com/browse/BSERV-8819",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/97515",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://confluence.atlassian.com/bitbucketserver/bitbucket-server-4-7-release-notes-829052416.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.atlassian.com/browse/BSERV-8819",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource."
    },
    {
      "lang": "es",
      "value": "Atlassian Bitbucket Server en versiones anteriores a 4.7.1 permite a atacantes remotos leer la primera línea de un archivo arbitrario a través de un ataque de salto de directorio en el recurso de solicitudes de extracción."
    }
  ],
  "lastModified": "2026-06-17T00:47:20.660",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82677FFC-00C8-46B2-B163-BD15D46F3B90",
              "versionEndExcluding": "4.7.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}